{
  "version": "2026-10-29",
  "tests": [
    {
      "id": "pipeda-rrosh",
      "regimeId": "pipeda",
      "jurisdiction": "federal",
      "appliesTo": [
        "private",
        "federal-private"
      ],
      "name": "PIPEDA",
      "statute": "Personal Information Protection and Electronic Documents Act, s. 10.1, and the Breach of Security Safeguards Regulations (SOR/2018-64)",
      "kind": "rrosh",
      "testWording": "An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual (s. 10.1(1)). Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual's personal information under the organization's control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual (s. 10.1(3)).",
      "harmDefinition": "Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property (s. 10.1(7)).",
      "factors": [
        "the sensitivity of the personal information involved in the breach",
        "the probability that the personal information has been, is being or will be misused",
        "any other prescribed factor (none has been prescribed)",
        "OPC on sensitivity: any information can be sensitive depending on the context; health and financial information, ethnic or racial origin, political opinions, genetic data, biometric data, sex life or sexual orientation and religious or philosophical beliefs are generally sensitive; look at both what was breached and the circumstances",
        "OPC on probability: what happened and how likely is it that someone would be harmed by the breach",
        "Who actually accessed or could have accessed the personal information",
        "How long has the personal information been exposed",
        "Is there evidence of malicious intent (theft, hacking)",
        "Were a number of pieces of personal information breached, raising the risk of misuse",
        "Is the information in the hands of a person who represents a reputation risk to the individual (an ex-spouse, a boss)",
        "Was the information exposed to limited, known entities who have committed to destroy and not disclose it, or to individuals unlikely to share it, or to unknown or many individuals, or to those likely to attempt to cause harm",
        "Has harm materialized (demonstration of misuse)",
        "Was the information lost, inappropriately accessed or stolen, and has it been recovered",
        "Is the personal information adequately encrypted, anonymized or otherwise not easily accessible"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Keep a record of every breach of security safeguards, whether or not it met the real risk of significant harm threshold, for 24 months after the day the organization determines the breach occurred, with enough detail to show the assessment (s. 10.3; SOR/2018-64 s. 6). Provide the records to the Commissioner on request.",
      "consequence": "Report to the Privacy Commissioner of Canada as soon as feasible, notify affected individuals as soon as feasible, and notify any other organization or government institution that may be able to reduce the risk of harm (ss. 10.1, 10.2).",
      "sources": [
        {
          "title": "PIPEDA s. 10.1 (Justice Laws)",
          "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/section-10.1.html",
          "section": "s. 10.1"
        },
        {
          "title": "PIPEDA ss. 10.2, 10.3 (Justice Laws)",
          "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html",
          "section": "ss. 10.2-10.3"
        },
        {
          "title": "Breach of Security Safeguards Regulations SOR/2018-64",
          "url": "https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/page-1.html",
          "section": "ss. 2, 3, 6"
        },
        {
          "title": "OPC: What you need to know about mandatory reporting of breaches of security safeguards (last modified 2025-08-11)",
          "url": "https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/"
        },
        {
          "title": "Breach of Security Safeguards Regulations SOR/2018-64 (full text)",
          "url": "https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/FullText.html",
          "section": "s. 6"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "privacy-act-material",
      "regimeId": "privacy-act-tbs",
      "jurisdiction": "federal",
      "appliesTo": [
        "federal-government"
      ],
      "name": "Privacy Act institutions (TBS Directive)",
      "statute": "Treasury Board Directive on Privacy Practices, Appendix B, Mandatory Procedures for Privacy Breaches",
      "kind": "rrosh",
      "testWording": "A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual (Policy on Privacy Protection, Appendix A, as restated in the TBS Privacy Breach Management Toolkit). A privacy breach is improper or unauthorized access to, creation, collection, use, disclosure, retention or disposal of personal information.",
      "factors": [
        "Assess how a reasonable person would react under similar circumstances",
        "The sensitivity of the personal information: the more sensitive, the greater the potential harm, and context changes sensitivity",
        "The potential harm to individuals and the likelihood of that harm materializing (risk to individuals)",
        "Materiality depends solely on the risk to the individual or individuals; a medium or high risk to individuals is treated as material",
        "The OPC privacy breach risk self-assessment tool (2025) is the supporting instrument"
      ],
      "harmExamples": [
        "physical injury or bodily harm",
        "embarrassment or humiliation",
        "damage to reputation or relationships",
        "loss of job, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on a credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Keep a record of every privacy breach, material or not, for five years after the date the institution discovered the breach; records of material breaches include the report sent to the OPC and TBS.",
      "consequence": "Report material privacy breaches to the Treasury Board Secretariat and the Privacy Commissioner no later than seven days after the institution determines the breach is material, and notify affected individuals unless notification would cause further harm (with the justification sent to the OPC and TBS).",
      "sources": [
        {
          "title": "TBS Privacy Breach Management Toolkit: definitions and scenarios",
          "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-1/definitions-scenarios.html"
        },
        {
          "title": "TBS Toolkit: Complete a risk assessment of the privacy breach",
          "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-2/complete-risk-assessment-privacy-breach.html"
        },
        {
          "title": "TBS Toolkit: Keep a record of the breach",
          "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/privacy-policies-guidance/breach-management/phase-4/keep-record-breach.html"
        },
        {
          "title": "TBS Privacy Implementation Notice 2024-02",
          "url": "https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information-privacy-notices/privacy-implementation-notice-2024-02.html",
          "section": "Directive App. B"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "ab-pipa-rrosh",
      "regimeId": "ab-pipa",
      "jurisdiction": "AB",
      "appliesTo": [
        "private"
      ],
      "name": "Alberta PIPA",
      "statute": "Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 34.1 and 37.1",
      "kind": "rrosh",
      "testWording": "An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure (s. 34.1(1)).",
      "harmDefinition": "PIPA does not define significant harm. The Commissioner: harm is some damage or detriment or injury to the individual; significant means important, meaningful, with non-trivial consequences or effects; a real risk means the likelihood is more than mere speculation or conjecture, with a cause and effect relationship between the incident and the possible harm. Rating the risk only as low, medium or high is not an assessment.",
      "factors": [
        "The nature (sensitivity) of the information involved",
        "Who obtained, or could have obtained, the information",
        "How many persons the information was exposed to",
        "Any personal or professional relationship between the affected individual and the unauthorized recipient",
        "Security measures in place, such as encryption, and any known flaws in them",
        "How long the information was exposed",
        "Evidence of malicious intent, such as theft, hacking or malware",
        "Whether the information could be used for criminal purposes, such as identity theft or fraud",
        "Whether the information was recovered",
        "How many individuals were affected",
        "Whether vulnerable individuals, such as youth or seniors, are involved",
        "The Commissioner's decisions add: absence of reported identity theft or fraud is not a mitigating factor, because identity theft can happen months or years after a breach; compromise by the malicious action of an unknown third party increases the likelihood of harm; safeguards added after the breach do not reduce the risk to affected individuals"
      ],
      "harmExamples": [
        "bodily harm",
        "embarrassment, hurt or humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "fraud",
        "negative effects on a credit record",
        "damage to or loss of property",
        "blackmail or extortion",
        "email phishing or spear phishing attacks"
      ],
      "recordKeeping": "No statutory breach register. The notice to the Commissioner must be in writing and include the circumstances, the date or period, the information involved, an assessment of the risk of harm to individuals, the estimated number of individuals at real risk of significant harm, the steps taken to reduce harm and to notify individuals, and a contact person (PIPA Regulation s. 19).",
      "consequence": "Notify the Commissioner without unreasonable delay; the Commissioner may then require the organization to notify affected individuals (s. 37.1), with an expedited process where the risk is obvious and immediate. Organizations may notify individuals on their own initiative.",
      "sources": [
        {
          "title": "OIPC Alberta: Guidance for Notifying the OIPC about a Privacy Breach Under PIPA (April 2024)",
          "url": "https://oipc.ab.ca/wp-content/uploads/2024/04/Guidance-for-Notifying-the-OIPC-about-a-Privacy-Breach-Under-PIPA-April-2024.pdf",
          "section": "PIPA s. 34.1, s. 37.1; Reg s. 19"
        },
        {
          "title": "OIPC Alberta: PIPA Privacy Breach Process (April 2024)",
          "url": "https://oipc.ab.ca/wp-content/uploads/2024/04/PIPA-Privacy-Breach-Process-April-2024.pdf"
        },
        {
          "title": "OIPC Alberta Breach Notification Decision P2023-ND-001",
          "url": "https://oipc.ab.ca/wp-content/uploads/2023/11/P2023-ND-001.pdf"
        },
        {
          "title": "OIPC Alberta: Breach Notification Requirements",
          "url": "https://oipc.ab.ca/breach-notification/"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "qc-serious-injury",
      "regimeId": "qc-law25",
      "jurisdiction": "QC",
      "appliesTo": [
        "private",
        "health-custodian"
      ],
      "name": "Quebec Law 25 (private sector)",
      "statute": "Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8",
      "kind": "serious-injury",
      "testWording": "If the incident presents a risk of serious injury, the person carrying on an enterprise must promptly notify the Commission d'acces a l'information and any person whose personal information is concerned by the incident (s. 3.5).",
      "harmDefinition": "In assessing the risk of injury to a person whose personal information is concerned by a confidentiality incident, the enterprise must consider, in particular, the sensitivity of the information concerned, the anticipated consequences of its use and the likelihood that such information will be used for injurious purposes, and must consult the person in charge of the protection of personal information (s. 3.7).",
      "factors": [
        "The sensitivity of the information concerned",
        "The anticipated consequences of its use",
        "The likelihood that the information will be used for injurious purposes",
        "The person in charge of the protection of personal information must be consulted"
      ],
      "harmExamples": [
        "identity theft",
        "fraud",
        "discrimination",
        "severe psychological distress",
        "threat to physical safety",
        "unwanted solicitation",
        "harassment",
        "manipulation",
        "damage to reputation (CAI guide, January 2026; the Act gives no list)"
      ],
      "recordKeeping": "Keep a register of every confidentiality incident, whether or not the risk of injury is serious, recording the information involved, the circumstances, the date or period, the date the enterprise became aware, the number of persons concerned, the elements leading it to conclude whether there is a risk of serious injury, the dates of any notices and the measures taken after the incident; keep each entry up to date for at least five years after awareness and provide a copy to the Commission on request (s. 3.8; Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1, ss. 7 and 8).",
      "consequence": "Notify the Commission d'acces a l'information and the persons concerned promptly, and take reasonable measures to reduce the risk of injury and prevent new incidents of the same nature (s. 3.5). Quebec has no separate health privacy act: private clinics and practices fall under this Act, public health institutions under the Access Act.",
      "sources": [
        {
          "title": "Act respecting the protection of personal information in the private sector (Legis Quebec, EN)",
          "url": "https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1",
          "section": "ss. 3.5-3.8"
        },
        {
          "title": "Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1 (Legis Quebec)",
          "url": "https://www.legisquebec.gouv.qc.ca/en/document/cr/a-2.1,%20r.%203.1",
          "section": "ss. 3, 5, 7, 8"
        },
        {
          "title": "CAI: Prevenir les incidents de confidentialite, guide explicatif pour les entreprises (January 2026)",
          "url": "https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_GU_ENTR_Prevention_incidents.pdf"
        },
        {
          "title": "CAI: Incidents de confidentialite et mesures de securite (entreprises)",
          "url": "https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/incidents-confidentialite-mesures-securite-entreprises"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "bc-pipa-voluntary",
      "regimeId": "bc-pipa",
      "jurisdiction": "BC",
      "appliesTo": [
        "private",
        "health-custodian"
      ],
      "name": "BC PIPA (voluntary)",
      "statute": "Personal Information Protection Act, S.B.C. 2003, c. 63",
      "kind": "significant-harm",
      "testWording": "PIPA contains no mandatory breach notification provision. The Commissioner recommends, as best practice, notifying affected individuals and reporting to the OIPC where a breach could reasonably be expected to result in significant harm.",
      "factors": [
        "OIPC checklist, when to report: the personal information involved is sensitive",
        "There is a risk of identity theft or other harm including pain and suffering or loss of reputation",
        "A large number of people are affected by the breach",
        "The information has not been fully recovered",
        "The breach is the result of a systemic problem or a similar breach has occurred before",
        "Risk factors: the type and volume of information, its potential for fraudulent or harmful use, whether the cause was malicious, the extent of containment, whether records were recovered or securely destroyed, and whether they were password protected or encrypted"
      ],
      "harmExamples": [
        "identity theft",
        "risk of physical harm",
        "humiliation and damage to personal or professional reputations",
        "loss of business or employment opportunities",
        "financial loss"
      ],
      "recordKeeping": "No statutory requirement; the OIPC recommends documenting every breach and the response.",
      "consequence": "British Columbia has no health-specific privacy act: private clinics and practices fall under PIPA, health authorities and hospitals under FIPPA. Voluntary as of 2026-10-29: no PIPA amendment has been introduced (Bill 9, 2026 amends FIPPA only). The OIPC strongly recommends notifying individuals and reporting to it where significant harm is reasonably possible. Organizations with customers outside BC, Alberta and Quebec are bound by PIPEDA's mandatory test as well.",
      "sources": [
        {
          "title": "OIPC BC: Breach notification for representatives of organizations and public bodies",
          "url": "https://oipc.bc.ca/resources/breach-notification-representatives-of-organizations-and-public-bodies/"
        },
        {
          "title": "OIPC BC: Privacy Breach Checklist for private organizations",
          "url": "https://www.oipc.bc.ca/guidance-documents/3749",
          "section": "Step 15"
        },
        {
          "title": "OIPC BC: Privacy breach quick reference guide for small and medium-sized businesses",
          "url": "https://oipc.bc.ca/documents/guidance-documents/3134"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "bc-fippa-significant-harm",
      "regimeId": "bc-fippa",
      "jurisdiction": "BC",
      "appliesTo": [
        "public-body",
        "health-custodian"
      ],
      "name": "BC FIPPA",
      "statute": "Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 36.3",
      "kind": "significant-harm",
      "testWording": "If a privacy breach involving personal information in the custody or under the control of a public body occurs, the head must, without unreasonable delay, notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual, and notify the commissioner if the privacy breach could reasonably be expected to result in such harm (s. 36.3(2)). A privacy breach is the theft or loss, or the collection, use or disclosure that is not authorized by Part 3, of personal information in the custody or under the control of a public body (s. 36.3(1)).",
      "harmDefinition": "Significant harm includes identity theft or significant (i) bodily harm, (ii) humiliation, (iii) damage to reputation or relationships, (iv) loss of employment, business or professional opportunities, (v) financial loss, (vi) negative impact on a credit record, or (vii) damage to, or loss of, property (s. 36.3(2)(a)). The FOIPPA Manual says the list is non-exhaustive and each breach needs a harms assessment.",
      "factors": [
        "The sensitivity, context, and amount of personal information involved",
        "The individuals affected",
        "The relationships of those involved",
        "Ability to contain the breach",
        "Whether the risk of harm from the breach outweighs the risk of further harm from notification (notice may be withheld only where it could reasonably be expected to result in immediate and grave harm to the individual's safety or health, or threaten another individual's, s. 36.3(3))",
        "OIPC BC checklist harm types: identity theft (most likely with SIN, credit card, driver's licence, personal health number or debit card with password), bodily harm including stalking or harassment, humiliation (medical or disciplinary records), damage to reputation or relationships, loss of opportunities, financial loss, credit impact, loss of property"
      ],
      "harmExamples": [
        "identity theft",
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "The privacy management program (s. 36.2) must include documented breach processes; s. 36.3 sets no retention period.",
      "consequence": "Notify affected individuals and the Information and Privacy Commissioner without unreasonable delay. Health authorities and hospitals in British Columbia are public bodies under FIPPA; private clinics fall under PIPA.",
      "sources": [
        {
          "title": "FIPPA s. 36.3 (BC Laws)",
          "url": "https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03",
          "section": "s. 36.3"
        },
        {
          "title": "BC Government FOIPPA Manual: Privacy breach notifications (updated 2026-04-22)",
          "url": "https://www2.gov.bc.ca/gov/content/governments/services-for-government/policies-procedures/foippa-manual/privacy-breach-notifications"
        },
        {
          "title": "BC Government: Guidance on Mandatory Privacy Breach Notifications",
          "url": "https://www2.gov.bc.ca/gov/content/governments/services-for-government/information-management-technology/privacy/guidance-on-mandatory-privacy-breach-notifications"
        },
        {
          "title": "OIPC BC: Privacy Breach Checklist for Public Bodies",
          "url": "https://oipc.bc.ca/guidance-documents/3748",
          "section": "Item 10"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "ab-popa-rrosh",
      "regimeId": "ab-popa",
      "jurisdiction": "AB",
      "appliesTo": [
        "public-body"
      ],
      "name": "Alberta POPA",
      "statute": "Protection of Privacy Act, S.A. 2024, c. P-30.5, s. 10, and the Protection of Privacy (Ministerial) Regulation s. 4",
      "kind": "rrosh",
      "testWording": "Where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss of, or unauthorized access to or disclosure of, personal information or data derived from it, the public body must notify the Commissioner, the Minister and the affected individuals.",
      "factors": [
        "Whether there is a reasonable basis to believe the information has been or may be misused",
        "Whether the loss, access or disclosure was the result of malicious intent",
        "The sensitivity of the information",
        "Mitigating measures taken, including recovery and encryption"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "The privacy management program (mandatory from June 11, 2026) must include breach handling and documentation.",
      "consequence": "Notify the Commissioner, the Minister and affected individuals as soon as reasonably practicable (s. 10(2)-(3)).",
      "sources": [
        {
          "title": "Government of Alberta fact sheet: POPA Privacy Incident Notifications",
          "url": "https://www.alberta.ca/system/files/ti-popa-fact-sheet-privacy-incident-motification.pdf",
          "section": "POPA s. 10(2)-(3); Reg s. 4"
        },
        {
          "title": "OIPC Alberta POPA Breach Notification Assessment Tool (June 2025)",
          "url": "https://oipc.ab.ca/wp-content/uploads/2025/06/POPA_Breach_Notification_Assessment_Tool_202506.pdf",
          "section": "Reg s. 4(1)"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "on-fippa-rrosh",
      "regimeId": "on-fippa",
      "jurisdiction": "ON",
      "appliesTo": [
        "public-body"
      ],
      "name": "Ontario FIPPA",
      "statute": "Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, s. 40.1 (Bill 194, Schedule 2, in force July 1, 2025)",
      "kind": "rrosh",
      "testWording": "Where personal information is stolen, lost or used or disclosed without authority and it is reasonable in the circumstances to believe that there is a real risk that a significant harm to an individual would result, or in other prescribed circumstances, the institution must notify the Commissioner and the affected individuals.",
      "harmDefinition": "Significant harm includes financial loss, identity theft and damage to reputation.",
      "factors": [
        "The sensitivity of the personal information",
        "The likelihood that the information has been or will be misused",
        "Steps taken to mitigate the breach",
        "Any guidance issued by the Commissioner"
      ],
      "harmExamples": [
        "financial loss",
        "identity theft",
        "damage to reputation"
      ],
      "recordKeeping": "Keep and maintain a record of every theft, loss or unauthorized use or disclosure reported to the Commissioner, for the annual statistical report (s. 40.1(8)).",
      "consequence": "Notify the Information and Privacy Commissioner and affected individuals as soon as feasible. Municipal institutions under MFIPPA have no statutory duty; the Commissioner recommends the same practice.",
      "sources": [
        {
          "title": "Bill 194 as passed (Legislative Assembly of Ontario)",
          "url": "https://ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194",
          "section": "Sch. 2 s. 6 (FIPPA s. 40.1)"
        },
        {
          "title": "IPC FAQ: Schedule 2 of Bill 194 / FIPPA amendments",
          "url": "https://www.ipc.on.ca/en/node/5061"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "qc-access-serious-injury",
      "regimeId": "qc-access-act",
      "jurisdiction": "QC",
      "appliesTo": [
        "public-body",
        "health-custodian"
      ],
      "name": "Quebec Access Act (public bodies)",
      "statute": "Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11",
      "kind": "serious-injury",
      "testWording": "A public body that has cause to believe a confidentiality incident has occurred must take reasonable measures to reduce the risk of injury; if the incident presents a risk of serious injury, it must promptly notify the Commission d'acces a l'information and the persons concerned (s. 63.8).",
      "factors": [
        "The sensitivity of the information concerned",
        "The anticipated consequences of its use",
        "The likelihood that the information will be used for injurious purposes",
        "The person in charge of the protection of personal information must be consulted (s. 63.10)"
      ],
      "harmExamples": [
        "identity theft",
        "fraud",
        "financial loss",
        "humiliation",
        "damage to reputation",
        "discrimination"
      ],
      "recordKeeping": "Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the Commission on request.",
      "consequence": "Notify the Commission d'acces a l'information and the persons concerned promptly. Public health institutions in Quebec are public bodies under this Act; private clinics fall under the private sector Act.",
      "sources": [
        {
          "title": "Loi sur l'acces (Legis Quebec, FR)",
          "url": "https://www.legisquebec.gouv.qc.ca/fr/document/lc/A-2.1",
          "section": "ss. 63.8-63.11"
        },
        {
          "title": "Reglement sur les incidents de confidentialite",
          "url": "https://www.legisquebec.gouv.qc.ca/fr/document/rc/A-2.1,%20r.%203.1",
          "section": "ss. 1-8"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "sk-foip-rrosh",
      "regimeId": "sk-foip",
      "jurisdiction": "SK",
      "appliesTo": [
        "public-body"
      ],
      "name": "Saskatchewan FOIP and LA FOIP",
      "statute": "The Freedom of Information and Protection of Privacy Act, s. 29.1; The Local Authority Freedom of Information and Protection of Privacy Act, s. 28.1",
      "kind": "rrosh",
      "testWording": "A government institution shall take all reasonable steps to notify an individual of an unauthorized use or disclosure of that individual's personal information by the government institution if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual (FOIP s. 29.1; LA FOIP s. 28.1 for local authorities). Neither Act defines significant harm or lists factors.",
      "factors": [
        "The Commissioner's privacy breach guidelines: sensitivity of the personal information, probability of misuse, whether the information was recovered or protected, and the harm the individual could suffer"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "No statutory register; the Commissioner's guidelines recommend documenting every breach and the response.",
      "consequence": "Take all reasonable steps to notify the affected individual. Reporting to the Commissioner is recommended, not required by statute.",
      "sources": [
        {
          "title": "FOIP (Saskatchewan) consolidated PDF",
          "url": "https://publications.saskatchewan.ca/api/v1/products/527/formats/694/download",
          "section": "s. 29.1"
        },
        {
          "title": "OIPC SK Privacy Breach Guidelines for Government Institutions and Local Authorities (May 2023)",
          "url": "https://oipc.sk.ca/assets/privacy-breach-guidelines-for-government-institutions-and-local-authorities.pdf"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "mb-fippa-rrosh",
      "regimeId": "mb-fippa",
      "jurisdiction": "MB",
      "appliesTo": [
        "public-body"
      ],
      "name": "Manitoba FIPPA",
      "statute": "The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, s. 41.1, and the FIPPA Regulation ss. 3.1 to 3.3",
      "kind": "rrosh",
      "testWording": "A public body must notify an individual of a privacy breach that, after considering the factors prescribed by regulation, could reasonably be expected to create a real risk of significant harm to the individual (s. 41.1(2)).",
      "factors": [
        "The factors prescribed by the FIPPA Regulation (ss. 3.1-3.3), including the sensitivity of the information and the probability of misuse",
        "Whether the information was recovered, encrypted or otherwise protected",
        "The number of individuals affected"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Not specified in the sources reviewed; document the assessment.",
      "consequence": "Notify the affected individual as soon as reasonably practicable; report to the Ombudsman as the Regulation requires.",
      "sources": [
        {
          "title": "Government of Manitoba: FIPPA Amendments (s. 41.1 breach notification)",
          "url": "https://gov.mb.ca/fippa/print,amend_detail.html",
          "section": "s. 41.1; Reg ss. 3.1-3.3"
        },
        {
          "title": "S.M. 2021, c. 43 (FIPPA amendments, s. 41.1 text)",
          "url": "https://web2.gov.mb.ca/laws/statutes/2021/c04321e.php",
          "section": "s. 41.1"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "ns-foipop-pending",
      "regimeId": "ns-foipop",
      "jurisdiction": "NS",
      "appliesTo": [
        "public-body"
      ],
      "name": "Nova Scotia FOIPOP (new Act from April 1, 2027)",
      "statute": "Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (current); new Act, S.N.S. 2025, c. 13, in force April 1, 2027",
      "kind": "significant-harm",
      "testWording": "The current Act has no breach notification duty; reporting to the Information and Privacy Commissioner is voluntary. The new Act introduces mandatory notification where a breach creates a real risk of significant harm, from April 1, 2027.",
      "factors": [
        "Sensitivity of the personal information",
        "Probability of misuse"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "None under the current Act.",
      "consequence": "Voluntary until April 1, 2027; thereafter notify the Commissioner and affected individuals where a real risk of significant harm exists.",
      "sources": [
        {
          "title": "Nova Scotia Legislature: Bill 150, Freedom of Information and Protection of Privacy Act (2025 c. 13)",
          "url": "https://nslegislature.ca/node/131065"
        },
        {
          "title": "Government of Nova Scotia news release, September 26, 2025",
          "url": "https://news.novascotia.ca/en/2025/09/26/province-introduces-modernized-access-privacy-legislation"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "nb-rtippa-significant-harm",
      "regimeId": "nb-rtippa",
      "jurisdiction": "NB",
      "appliesTo": [
        "public-body"
      ],
      "name": "New Brunswick RTIPPA",
      "statute": "Right to Information and Protection of Privacy Act, General Regulation 2010-111, s. 4.2",
      "kind": "significant-harm",
      "testWording": "Where it is reasonable to believe that a privacy breach creates a risk of significant harm to an individual, considering the sensitivity of the information and the probability of misuse, the public body must notify the individual and the Ombud.",
      "harmDefinition": "Significant harm includes humiliation, damage to reputation or relationships, financial loss, identity theft and damage to property.",
      "factors": [
        "The sensitivity of the personal information",
        "The probability that the information has been, is being or will be misused"
      ],
      "harmExamples": [
        "humiliation",
        "damage to reputation or relationships",
        "financial loss",
        "identity theft",
        "damage to property"
      ],
      "recordKeeping": "Investigate every actual or suspected breach and maintain a registry of every actual privacy breach and the corrective measures taken (Reg s. 4.2(4)(b)).",
      "consequence": "Notify the affected individual and the Ombud.",
      "sources": [
        {
          "title": "N.B. Regulation 2018-24 (laws.gnb.ca)",
          "url": "https://laws.gnb.ca/en/document/ar/2018-24",
          "section": "Reg 2010-111 s. 4.2"
        },
        {
          "title": "GNB: Handling privacy breaches",
          "url": "https://www.gnb.ca/en/gov/information-access-privacy/resources-gov-public-bodies/handling-privacy-breaches.html"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "nl-atippa-significant-harm",
      "regimeId": "nl-atippa",
      "jurisdiction": "NL",
      "appliesTo": [
        "public-body"
      ],
      "name": "NL ATIPPA, 2015",
      "statute": "Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2, s. 64",
      "kind": "significant-harm",
      "testWording": "Individuals must be notified at the first reasonable opportunity when personal information is stolen, lost, improperly disposed of, or accessed or disclosed without authority, unless the head reasonably believes the breach creates no risk of significant harm (s. 64(3), (7)). The commissioner must be informed of every breach involving unauthorized collection, use or disclosure, regardless of harm (s. 64(4)).",
      "harmDefinition": "Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 64(8)).",
      "factors": [
        "The sensitivity of the personal information (s. 64(9)(a))",
        "The probability that the personal information has been, is being or will be misused (s. 64(9)(b))"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Not specified in s. 64; document the assessment.",
      "consequence": "Notify individuals at the first reasonable opportunity unless the head reasonably believes there is no risk of significant harm (the commissioner may still recommend notification); inform the commissioner of every reasonably believed breach involving unauthorized collection, use or disclosure.",
      "sources": [
        {
          "title": "ATIPPA, 2015 (House of Assembly consolidated statutes)",
          "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/a01-2.htm",
          "section": "s. 64"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "pe-foipp-voluntary",
      "regimeId": "pe-foipp",
      "jurisdiction": "PE",
      "appliesTo": [
        "public-body"
      ],
      "name": "PEI FOIPP (voluntary)",
      "statute": "Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01",
      "kind": "significant-harm",
      "testWording": "The FOIPP Act contains no breach notification duty. The Commissioner encourages voluntary reporting using the same process as the Health Information Act, assessing the risk of harm to individuals.",
      "factors": [
        "Sensitivity of the personal information",
        "Probability of misuse",
        "Whether the breach will adversely affect the individual"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "None required; document the assessment.",
      "consequence": "Voluntary: report to the Commissioner and notify individuals where harm is reasonably possible.",
      "sources": [
        {
          "title": "PEI OIPC Privacy Breach Reporting Guidelines",
          "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "yt-atipp-significant-harm",
      "regimeId": "yt-atipp",
      "jurisdiction": "YT",
      "appliesTo": [
        "public-body"
      ],
      "name": "Yukon ATIPP Act",
      "statute": "Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9, ss. 30 to 32",
      "kind": "significant-harm",
      "testWording": "The Designated Privacy Officer assesses each privacy breach; if there is a risk of significant harm to an individual, all affected individuals must be notified and the Information and Privacy Commissioner and the head informed (s. 32). Significant harm means bodily harm, personal humiliation, reputational or relationship damage, loss of employment, business or professional opportunities, financial loss, negative effects on a credit rating, or damage to or loss of property, or any other similar type of harm (s. 1).",
      "factors": [
        "The sensitivity of the personal information (s. 32(6)(a))",
        "The probability that the personal information is, has been or will be used or disclosed in an unauthorized manner (s. 32(6)(b))",
        "The number of affected individuals",
        "Any relationship between the affected individuals and a recipient",
        "The time elapsed since the breach",
        "Mitigation measures taken",
        "Whether lost or stolen information was recovered",
        "Any other information that is relevant in the circumstances and is reasonably available (s. 32(6)(h))"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property",
        "any other similar type of harm"
      ],
      "recordKeeping": "Keep a written record of each privacy breach; the report to the Commissioner must give the reasons for the risk finding and a copy of the individual notice.",
      "consequence": "Notify affected individuals and inform the Commissioner and the head of the public body.",
      "sources": [
        {
          "title": "Yukon Government Privacy Breach Procedures (May 2021)",
          "url": "https://open.yukon.ca/fr/information/da85dad0-08a1-48c8-8c39-f187771def1e/resource/5c2c400b-7c92-3e40-8385-960b53068855/download/privacy-breach-procedures-may-2021.pdf",
          "section": "ATIPP ss. 30, 32"
        },
        {
          "title": "Yukon University Privacy Breach Procedures IT 11.1 (March 2025), reproducing ATIPP s. 1 and s. 32(6)",
          "url": "https://www.yukonu.ca/sites/default/files/policies/IT%2011.1%20-%20Privacy%20Breach%20Procedures_approved%20Mar%2018%202025.pdf",
          "section": "ATIPP s. 1, s. 32(6)"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "nt-atipp-rrosh",
      "regimeId": "nt-atipp",
      "jurisdiction": "NT",
      "appliesTo": [
        "public-body"
      ],
      "name": "NWT ATIPP Act",
      "statute": "Access to Information and Protection of Privacy Act (NWT), ss. 49.9 and 49.10",
      "kind": "rrosh",
      "testWording": "Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).",
      "factors": [
        "The sensitivity of the personal information",
        "The probability that the information has been, is being or will be misused",
        "For the report to the Commissioner: the number of individuals affected, the likelihood of harm and whether the cause of the breach is systemic"
      ],
      "harmDefinition": "Harm includes bodily harm, humiliation, damage to reputation, damage to a relationship, loss of employment, business or professional opportunity, negative effects on credit records, damage to or loss of property, financial loss and identity theft (s. 49.7).",
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Document the assessment; no retention period identified in the sources reviewed.",
      "consequence": "Notify affected individuals as soon as reasonably possible where a real risk of significant harm exists, with enough information to understand the significance and take protective steps; report material breaches to the Commissioner as soon as reasonably possible after determining materiality; notify other bodies that can mitigate the harm (s. 49.11).",
      "sources": [
        {
          "title": "An Act to Amend the ATIPP Act, S.N.W.T. 2019, c. 8",
          "url": "https://laws.opennwt.ca/bills/snwt-2019-c08/?lang=en",
          "section": "ss. 49.7-49.11"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "nu-atipp-rrosh",
      "regimeId": "nu-atipp",
      "jurisdiction": "NU",
      "appliesTo": [
        "public-body"
      ],
      "name": "Nunavut ATIPP Act",
      "statute": "Access to Information and Protection of Privacy Act (Nunavut), Division E, ss. 49.7 to 49.14 (added by S.Nu. 2012, c. 13)",
      "kind": "rrosh",
      "testWording": "Notify affected individuals if it is reasonable to believe the breach creates a real risk of significant harm, considering the sensitivity of the information and the probability of misuse (s. 49.10). Report to the Commissioner only if the breach is material, considering sensitivity, the number of individuals, the likelihood of harm and whether the cause is systemic (s. 49.9).",
      "factors": [
        "The sensitivity of the personal information",
        "The probability that the information has been, is being or will be misused",
        "For the report to the Commissioner: the number of individuals affected, the likelihood of harm and whether the cause of the breach is systemic"
      ],
      "harmDefinition": "Harm includes bodily harm, humiliation, damage to reputation, damage to a relationship, loss of employment, business or professional opportunity, negative effects on credit records, damage to or loss of property, financial loss and identity theft (s. 49.7).",
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Document the assessment; no retention period identified in the sources reviewed.",
      "consequence": "Notify affected individuals as soon as reasonably possible where a real risk of significant harm exists, with enough information to understand the significance and take protective steps; report material breaches to the Commissioner as soon as reasonably possible after determining materiality; notify other bodies that can mitigate the harm (s. 49.11).",
      "sources": [
        {
          "title": "An Act to Amend the Access to Information and Protection of Privacy Act, S.Nu. 2012, c. 13",
          "url": "https://nunavutlegislation.ca/in/file-download/download/public/3201",
          "section": "ss. 49.7-49.11"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "on-phipa-none",
      "regimeId": "on-phipa",
      "jurisdiction": "ON",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "Ontario PHIPA",
      "statute": "Personal Health Information Protection Act, 2004, s. 12, and O. Reg. 329/04 ss. 6.3 to 6.4",
      "kind": "none",
      "testWording": "A health information custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the information is stolen or lost or if it is used or disclosed without authority (s. 12(2)). The Commissioner must be notified where a prescribed circumstance exists (s. 12(3)).",
      "factors": [
        "Prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3): use or disclosure without authority by a person who knew or ought to have known it was unauthorized",
        "The information was stolen",
        "Further use or disclosure without authority after an initial loss or unauthorized use or disclosure",
        "The incident is part of a pattern of similar incidents",
        "The custodian is required to give notice to a College of a disciplinary matter",
        "The custodian would have been required to give notice to a College had the agent been a member",
        "The incident is significant having regard to the sensitivity of the information, the number of individuals and custodians or agents involved, and the circumstances"
      ],
      "harmExamples": [],
      "recordKeeping": "Keep records sufficient to produce the annual statistical report to the Commissioner (O. Reg. 329/04 s. 6.4) and retain the breach documentation.",
      "consequence": "Notify the individual at the first reasonable opportunity in every case; notify the Commissioner where a prescribed circumstance exists; report annual statistics by March 1.",
      "sources": [
        {
          "title": "IPC Ontario: Reporting a Privacy Breach to the Commissioner, Guidelines for the Health Sector (March 2021, reproduces O. Reg. 329/04 s. 6.3)",
          "url": "https://ipc.on.ca/media/3430/download",
          "section": "s. 6.3"
        },
        {
          "title": "IPC: Regulations, prescribed circumstances for notifying the Commissioner (O. Reg. 329/04 s. 6.3)",
          "url": "https://www.ipc.on.ca/en/node/2484",
          "section": "s. 6.3"
        },
        {
          "title": "IPC breach report form",
          "url": "https://www.ipc.on.ca/en/resources/forms/report-privacy-breach-your-organization"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "ab-hia-risk-of-harm",
      "regimeId": "ab-hia",
      "jurisdiction": "AB",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "Alberta HIA",
      "statute": "Health Information Act, R.S.A. 2000, c. H-5, s. 60.1, and the Health Information Regulation s. 8.1",
      "kind": "risk-of-harm",
      "testWording": "A custodian must, as soon as practicable, give notice of any loss of, or unauthorized access to or disclosure of, individually identifying health information in its custody or control where the custodian determines there is a risk of harm to an individual as a result (s. 60.1(2)).",
      "harmDefinition": "Harm is some damage or detriment or injury that could be caused to affected individuals because of the incident (OIPC). The custodian must consider all relevant factors, including those in the Health Information Regulation s. 8.1.",
      "factors": [
        "(a) whether there is a reasonable basis to believe that the information has been or may be accessed by a person",
        "(b) whether there is a reasonable basis to believe that the information has been misused or will be misused",
        "(c) whether the information could be used for the purpose of identity theft or to commit fraud",
        "(d) whether the information is of a type that could cause embarrassment or physical, mental or financial harm to the individual",
        "(e) whether the loss or unauthorized access or disclosure has adversely affected or will adversely affect the provision of a health service to the individual",
        "(f) for electronic information, whether the custodian can demonstrate it was encrypted or otherwise secured in a manner that would prevent unauthorized access or render it unintelligible",
        "(g) for lost information, whether it was destroyed or rendered inaccessible or unintelligible",
        "(h) for recovered lost information, whether the custodian can demonstrate it was not accessed before it was recovered",
        "(i) for unauthorized access or disclosure, whether the only recipient was a custodian or affiliate subject to confidentiality policies who acted within their duties, did not use the information for an improper purpose and used it only to address the error"
      ],
      "harmExamples": [
        "identity theft",
        "fraud",
        "embarrassment",
        "mental harm",
        "physical harm",
        "financial harm",
        "damage to reputation",
        "adverse effect on the provision of a health service"
      ],
      "recordKeeping": "No general breach record duty in s. 60.1; a decision not to notify an individual because notice could harm their mental or physical health must be reported to the Commissioner immediately with the breach report (Regulation s. 8.3). Affiliates must notify the custodian as soon as practicable (s. 60.1(1)).",
      "consequence": "Notify the Commissioner, the Minister of Health and the affected individuals as soon as practicable.",
      "sources": [
        {
          "title": "OIPC Alberta: Breach Reporting (HIA s. 60.1 and Regulation s. 8.1)",
          "url": "https://oipc.ab.ca/wp-content/uploads/2024/04/Breach-Reporting-2018.pdf",
          "section": "s. 60.1; Reg s. 8.1"
        },
        {
          "title": "OIPC Alberta: Breach Notification Requirements",
          "url": "https://oipc.ab.ca/breach-notification/",
          "section": "s. 60.1"
        },
        {
          "title": "OIPC Alberta: Mandatory privacy breach reporting in Alberta's health sector",
          "url": "https://oipc.ab.ca/hia-breach-reporting/"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "mb-phia-rrosh",
      "regimeId": "mb-phia",
      "jurisdiction": "MB",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "Manitoba PHIA",
      "statute": "The Personal Health Information Act, C.C.S.M. c. P33.5, s. 19.0.1",
      "kind": "rrosh",
      "testWording": "A trustee must notify the individual if a privacy breach could reasonably be expected to create a real risk of significant harm to the individual, having regard to the prescribed factors (s. 19.0.1(2)), as soon as practicable after the breach becomes known, directly and in the prescribed form (s. 19.0.1(3)), and must also notify the Ombudsman (s. 19.0.1(4)).",
      "harmDefinition": "Significant harm includes bodily harm, humiliation, damage to the individual's reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 19.0.1(1)).",
      "factors": [
        "(a) the sensitivity of the personal health information involved",
        "(b) the probability that the information could be used to cause significant harm, having regard for: (i) the event that caused the breach, including evidence of malicious intent such as theft or unauthorized access to a computer system",
        "(ii) the number of persons who actually or potentially accessed the information",
        "(iii) whether the identity of those persons is known or unknown",
        "(iv) any known relationship between those persons and the individual, and its nature",
        "(v) whether the trustee is reasonably satisfied that any such person has destroyed unauthorized copies and committed not to use or disclose it",
        "(vi) the length of time since the breach first occurred and the period the information was available to be accessed, used, disclosed, destroyed or altered",
        "(vii) the amount of personal health information involved",
        "(viii) whether the information has been recovered",
        "(ix) whether it was adequately encrypted, anonymized or otherwise not easily accessible",
        "(x) whether harm has materialized",
        "(c) any other factors that are reasonably relevant in the circumstances (Personal Health Information Regulation s. 8.7)"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Not specified in s. 19.0.1; the notice must contain the nine prescribed elements (Regulation s. 8.8), so keep the assessment that supports them.",
      "consequence": "Notify the affected individual directly and in the prescribed form as soon as practicable, and notify the Ombudsman.",
      "sources": [
        {
          "title": "Manitoba PHIA (C.C.S.M. c. P33.5) consolidated",
          "url": "https://web2.gov.mb.ca/laws/statutes/ccsm/_pdf.php?cap=p33.5",
          "section": "s. 19.0.1"
        },
        {
          "title": "Personal Health Information Regulation, M.R. 245/97",
          "url": "https://web2.gov.mb.ca/laws/regs/current/_pdf-regs.php?reg=245/97",
          "section": "ss. 8.7-8.9"
        },
        {
          "title": "Manitoba Ombudsman practice note: Privacy breaches, key steps (January 2022)",
          "url": "https://www.ombudsman.mb.ca/wp-content/uploads/2025/11/PN-FIPPA-PHIA-breach-key-steps-EN.pdf"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "sk-hipa-practice",
      "regimeId": "sk-hipa",
      "jurisdiction": "SK",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "Saskatchewan HIPA (Commissioner's practice)",
      "statute": "The Health Information Protection Act, S.S. 1999, c. H-0.021, s. 16; LA FOIP s. 28.1 for trustees that are local authorities",
      "kind": "rrosh",
      "testWording": "HIPA contains no breach notification provision and no significant harm test (consolidation with amendments to 2024, c. 4). The Commissioner directs trustees to follow the LA FOIP s. 28.1 practice: notify individuals where a real risk of significant harm exists, and report to the Commissioner within ten calendar days of initiating containment.",
      "factors": [
        "Sensitivity of the personal health information",
        "Probability of misuse",
        "Whether the information was recovered or protected"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Not specified; document the assessment.",
      "consequence": "Notify individuals where a real risk of significant harm exists (mandatory for trustees that are local authorities under LA FOIP s. 28.1); report to the Commissioner as recommended.",
      "sources": [
        {
          "title": "OIPC SK Investigation Report 193-2024, 043-2025 (SHA)",
          "url": "https://oipc.sk.ca/assets/hipa-investigation_193-2024-043-2025.pdf"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "nb-phipaa-adverse-impact",
      "regimeId": "nb-phipaa",
      "jurisdiction": "NB",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "New Brunswick PHIPAA",
      "statute": "Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, s. 49",
      "kind": "risk-of-harm",
      "testWording": "A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure of or access to personal health information, unless the custodian reasonably believes the incident will not adversely impact the provision of health care or other benefits, will not adversely affect the individual's mental, physical, economic or social well-being, and will not lead to the identification of the individual (s. 49(2)).",
      "factors": [
        "Whether the incident could adversely impact the provision of health care or other benefits",
        "Whether it could adversely affect the individual's mental, physical, economic or social well-being",
        "Whether it could lead to identification of the individual"
      ],
      "harmExamples": [
        "adverse impact on health care or benefits",
        "harm to mental, physical, economic or social well-being",
        "identification of the individual"
      ],
      "recordKeeping": "Not specified in s. 49; document the assessment.",
      "consequence": "Notify the individual and the Ombud at the first reasonable opportunity, in the prescribed manner, unless all three exceptions are reasonably believed to apply (s. 49(1)(c), (2)).",
      "sources": [
        {
          "title": "PHIPAA (laws.gnb.ca, consolidated)",
          "url": "https://laws.gnb.ca/en/showfulldoc/cs/P-7.05/",
          "section": "s. 49(1)(c), s. 49(2)"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "ns-phia-harm-or-embarrassment",
      "regimeId": "ns-phia",
      "jurisdiction": "NS",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "Nova Scotia PHIA",
      "statute": "Personal Health Information Act, S.N.S. 2010, c. 41, ss. 69 and 70",
      "kind": "harm-or-embarrassment",
      "testWording": "Where a custodian believes on a reasonable basis that personal health information has been stolen, lost, or accessed or disclosed without authority, and that this creates potential for harm or embarrassment to the individual, the custodian must notify the individual at the first reasonable opportunity (s. 69). A custodian that decides not to notify because there is no potential for harm or embarrassment must instead notify the Review Officer (s. 70).",
      "factors": [
        "Whether the information was stolen, lost or accessed or disclosed without authority",
        "Whether this creates potential for harm or embarrassment to the individual"
      ],
      "harmExamples": [
        "harm",
        "embarrassment"
      ],
      "recordKeeping": "Not specified; document the assessment and any decision not to notify.",
      "consequence": "Notify the individual, or, where you conclude there is no potential for harm or embarrassment, notify the Review Officer of that decision.",
      "sources": [
        {
          "title": "Nova Scotia PHIA (consolidated PDF)",
          "url": "https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdf",
          "section": "ss. 69, 70"
        },
        {
          "title": "OIPC Nova Scotia: Reporting Breaches, s. 70 of PHIA guidelines (reissued 2025-11-06)",
          "url": "https://oipc.novascotia.ca/sites/default/files/2025%2011%2006%20S.%2070%20PHIA%20Guidelines.pdf"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "nl-phia-adverse-effect",
      "regimeId": "nl-phia",
      "jurisdiction": "NL",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "NL PHIA",
      "statute": "Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 15",
      "kind": "risk-of-harm",
      "testWording": "A custodian must notify the individual of any theft, loss, improper disposal, or unauthorized disclosure or access, unless the custodian reasonably believes it will not adversely affect the provision of health care or other benefits to the individual, or the individual's mental, physical, economic or social well-being (s. 15(3), (7)). The commissioner must be informed of a material breach involving unauthorized collection, use or disclosure.",
      "factors": [
        "Whether the incident will adversely affect the provision of health care or other benefits to the individual (s. 15(7)(a))",
        "Whether it will adversely affect the individual's mental, physical, economic or social well-being (s. 15(7)(b))",
        "For the commissioner, materiality under the Regulations s. 5: (a) the sensitivity of the personal health information involved; (b) the number of people whose information was involved; (c) whether the custodian reasonably believes the information has been or will be misused; (d) whether the cause of the breach or the pattern of breaches indicates a systemic problem"
      ],
      "harmExamples": [
        "adverse effect on health care or benefits",
        "harm to mental, physical, economic or social well-being"
      ],
      "recordKeeping": "Not specified; document the assessment.",
      "consequence": "Notify the individual at the first reasonable opportunity unless the exception is reasonably believed to apply; inform the commissioner of material breaches.",
      "sources": [
        {
          "title": "NL PHIA (House of Assembly consolidated statutes)",
          "url": "https://www.assembly.nl.ca/Legislation/sr/statutes/p07-01.htm",
          "section": "s. 15"
        },
        {
          "title": "Personal Health Information Regulations, N.L.R. 38/11",
          "url": "https://www.assembly.nl.ca/legislation/sr/regulations/rc110038.htm",
          "section": "s. 5"
        }
      ],
      "lastVerified": "2026-10-29"
    },
    {
      "id": "pe-hia-adverse-impact",
      "regimeId": "pe-hia",
      "jurisdiction": "PE",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "PEI Health Information Act",
      "statute": "Health Information Act, R.S.P.E.I. 1988, c. H-1.41",
      "kind": "risk-of-harm",
      "testWording": "A custodian must notify the individual of theft, loss, or unauthorized access or disclosure of personal health information, unless the custodian reasonably believes the breach will not have an adverse impact on the provision of health care or other benefits, or on the individual's mental, physical, economic or social well-being.",
      "factors": [
        "Whether the breach could adversely impact health care or other benefits",
        "Whether it could adversely affect the individual's mental, physical, economic or social well-being"
      ],
      "harmExamples": [
        "adverse impact on health care or benefits",
        "harm to mental, physical, economic or social well-being"
      ],
      "recordKeeping": "Not specified; the Commissioner's guidelines expect documentation.",
      "consequence": "Notify the individual, and the Commissioner, as the Act and the Commissioner's guidelines require.",
      "sources": [
        {
          "title": "PEI OIPC Privacy Breach Reporting Guidelines",
          "url": "https://www.assembly.pe.ca/sites/www.assembly.pe.ca/files/oipc-privacy-breach-reporting-guidelines.pdf"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "yt-hipma-significant-harm",
      "regimeId": "yt-hipma",
      "jurisdiction": "YT",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "Yukon HIPMA",
      "statute": "Health Information Privacy and Management Act, S.Y. 2013, c. 16, ss. 30 and 31",
      "kind": "significant-harm",
      "testWording": "Where there is a likelihood of significant harm to an individual from a security breach, the custodian must notify the individual and the Commissioner; where there is no such likelihood no notice is required.",
      "factors": [
        "Sensitivity of the personal health information",
        "Probability of misuse",
        "Whether the information was recovered or protected"
      ],
      "harmExamples": [
        "bodily harm",
        "humiliation",
        "damage to reputation or relationships",
        "loss of employment, business or professional opportunities",
        "financial loss",
        "identity theft",
        "negative effects on the credit record",
        "damage to or loss of property"
      ],
      "recordKeeping": "Not specified; document the assessment.",
      "consequence": "Notify the individual and the Commissioner where significant harm is likely.",
      "sources": [
        {
          "title": "Yukon HSS Sample Breach Protocol (cites HIPMA ss. 30-31)",
          "url": "https://yukon.ca/sites/yukon.ca/files/hss/hss-sample-breach-protocol.pdf",
          "section": "ss. 30-31"
        }
      ],
      "lastVerified": "2026-10-29",
      "verbatimUnverified": true
    },
    {
      "id": "nt-hia-risk-of-harm",
      "regimeId": "nt-hia",
      "jurisdiction": "NT",
      "appliesTo": [
        "health-custodian"
      ],
      "name": "NWT Health Information Act",
      "statute": "Health Information Act, S.N.W.T. 2014, c. 2, s. 87, and the Health Information Regulations ss. 14 and 15",
      "kind": "risk-of-harm",
      "testWording": "Notify affected individuals of any inappropriate access, loss or theft of personal health information (s. 87). Notify the Commissioner and law enforcement where information is lost or stolen, or where fraud or identity theft leads to disclosure, alteration, destruction or disposal, unless the incident does not present a reasonable risk of harm (Regulation s. 15).",
      "factors": [
        "Whether the incident presents a reasonable risk of harm to the individual",
        "Whether the information was lost, stolen or obtained by fraud or identity theft"
      ],
      "harmExamples": [
        "identity theft",
        "fraud",
        "harm to the individual"
      ],
      "recordKeeping": "Investigate, and keep a record of the breach and the corrective measures taken (Regulation s. 14).",
      "consequence": "Notify affected individuals; notify the Commissioner and law enforcement where a reasonable risk of harm exists.",
      "sources": [
        {
          "title": "NWT Health Information Regulations",
          "url": "https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.r1.pdf",
          "section": "ss. 14-15"
        }
      ],
      "lastVerified": "2026-10-29"
    }
  ],
  "_meta": {
    "title": "Canadian breach harm thresholds",
    "publisher": "Frontier Cyber",
    "homepage": "https://frontiercyber.app/tools/harm-assessment/",
    "license": "CC BY 4.0",
    "disclaimer": "General information, not legal advice. Each test carries a lastVerified date and primary sources; confirm against the source before relying on it."
  }
}